hxxps://experiments[.]turbowarp[.]org/pointerlock/1383134605?fps=60&turbo&clones=Infinity&offscreen&limitless&hqpen&size=640x480

Analysis

user interaction
yes
max time kernel
44s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://experiments.turbowarp.org/pointerlock/1383134605?fps=60&turbo&clones=Infinity&offscreen&limitless&hqpen&size=640x480
Sample261026-w8xdcsbf98

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2772	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{6824473D-FDCD-46E4-95DC-EBBB7281CD28}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 2620	4572	msedge.exe	85
PID 4572 wrote to memory of 2772	4572	msedge.exe	86
PID 4572 wrote to memory of 1900	4572	msedge.exe	87
PID 4572 wrote to memory of 1900	4572	msedge.exe	87
PID 4572 wrote to memory of 1900	4572	msedge.exe	87
PID 4572 wrote to memory of 5092	4572	msedge.exe	88
PID 4572 wrote to memory of 5092	4572	msedge.exe	88
PID 4572 wrote to memory of 1864	4572	msedge.exe	90
PID 4572 wrote to memory of 1864	4572	msedge.exe	90
PID 4572 wrote to memory of 1864	4572	msedge.exe	90
PID 4572 wrote to memory of 4936	4572	msedge.exe	91
PID 4572 wrote to memory of 4936	4572	msedge.exe	91
PID 4572 wrote to memory of 4936	4572	msedge.exe	91
PID 4572 wrote to memory of 4848	4572	msedge.exe	92
PID 4572 wrote to memory of 4848	4572	msedge.exe	92
PID 4572 wrote to memory of 4848	4572	msedge.exe	92
PID 4572 wrote to memory of 1856	4572	msedge.exe	93
PID 4572 wrote to memory of 1856	4572	msedge.exe	93
PID 4572 wrote to memory of 1856	4572	msedge.exe	93
PID 4572 wrote to memory of 980	4572	msedge.exe	96
PID 4572 wrote to memory of 980	4572	msedge.exe	96
PID 4572 wrote to memory of 980	4572	msedge.exe	96
PID 4572 wrote to memory of 1608	4572	msedge.exe	98
PID 4572 wrote to memory of 1608	4572	msedge.exe	98
PID 4572 wrote to memory of 2084	4572	msedge.exe	99
PID 4572 wrote to memory of 2084	4572	msedge.exe	99
PID 4572 wrote to memory of 1848	4572	msedge.exe	100
PID 4572 wrote to memory of 1848	4572	msedge.exe	100
PID 4572 wrote to memory of 1620	4572	msedge.exe	102
PID 4572 wrote to memory of 3940	4572	msedge.exe	103
PID 4572 wrote to memory of 3940	4572	msedge.exe	103
PID 4572 wrote to memory of 3940	4572	msedge.exe	103
PID 4572 wrote to memory of 4724	4572	msedge.exe	112
PID 4572 wrote to memory of 2092	4572	msedge.exe	113
PID 4572 wrote to memory of 3104	4572	msedge.exe	114
PID 4572 wrote to memory of 4412	4572	msedge.exe	116
PID 4572 wrote to memory of 4412	4572	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://experiments.turbowarp.org/pointerlock/1383134605?fps=60&turbo&clones=Infinity&offscreen&limitless&hqpen&size=640x480
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90fa7c188,0x7ff90fa7c194,0x7ff90fa7c1a0
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,7223385354429175206,15621893702133652241,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,14395328358393717773,1359609545811487746,262144 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,10338481683595639537,13584942272812678434,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,8239028925582517295,8673953987571032052,2097152 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,1864522524953169149,14445126625252457386,2097152 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,1047848139979306498,3207158920247026520,2097152 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,5547130477340545154,1930125871090455384,2097152 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,8029791968260105811,9011463576322111572,2097152 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,8780729491159033325,18211265123501096921,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,2363004762627300352,2394334307217882030,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,8393291785684890100,6406129733693439060,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,14280594136306511852,3983856961898043280,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,14280594136306511852,3983856961898043280,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6400,i,3106433521063308925,911373589351400838,2097152 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,18355259884331355617,11368842644766541760,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,9723372747101409292,12006458996060036197,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,7530086770049962594,5521946684557960032,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,13537093568738538442,6101467820373334196,524288 --field-trial-handle=2236,i,10544263867068692338,16798821554504674850,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

261c6c61-a209-43fc-802a-54becc397941.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\261c6c61-a209-43fc-802a-54becc397941.tmp
Size 8KB
SHA256 abc9ec26f8f51eca6dc02bfd229c19a39d568bf3333e2091c484d2f85b92b1c3
MD5 48e47ee2058cf05c9b3017b745a66a74
SHA1 ccba4d15c0ec949dd7af63c1883a161c5ff4e774
SHA512 be5fd06ed5b442b414b30e583f7b0fbcd05045688a8c54d37f329385feee9574c038c4b02d19a15bfdb617af66b0216350351cce03490bdbf9edc245c9fc13b8
SSDEEP 192:jON16wlD6QmiUyebr4X58gZcOKBJsUakTveFAiqpU6:jON16k23r4X58EcOWJsUaHSU6
TLSH
T140121931B568AC3B5DF2A549F48336139FA55267EA896F90C6DC2A1C01EE2AC130EC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3da0ad71-5aa7-4ab4-bdbe-536571cdd86a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3da0ad71-5aa7-4ab4-bdbe-536571cdd86a.tmp
Size 18KB
SHA256 737ac1f84f99aa0dad55810ce4af9c498465bc946b0e1ae2240c630b78166dec
MD5 f09aeefa34973f8c1677ac747124e413
SHA1 aa965b3eed95658169145832fd0161aaa8216f36
SHA512 214e54cc138c9ad0b6520b5c60a7fceb86a7693fc4d46d4fca8480ef3fdc4a2b084828e7c53090010fe99384d7d401bf06798b68dde6b3b88c5c465f56271553
SSDEEP 384:iQkUSv0sN0j0DZ/bJHX58EcOWJsUaAS2IguJIIlv:a0sxdabOV2S5guJLp
TLSH
T176828D31A868AD379EF6A544F14A3603DFB49153E6886F94C6CD6B1C01DE2EC130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5191c0c1-9cd4-42a8-9fa1-c3c5b6eab79c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5191c0c1-9cd4-42a8-9fa1-c3c5b6eab79c.tmp
Size 18KB
SHA256 2eebaad098aa46f0fef8bd1afc73b93595695c609c78f597d6a77b5d17fb80f5
MD5 3b237a56bf773254b58f45e0e9ff7409
SHA1 abd99416e6b724f768c4327309d71e7d6ae77f31
SHA512 b038b67cc6a03633e93a5f803870004b28c36d09838a15b46266fc27929398c8f4f713e1509b0a2810273837455ea1a8c77e762a313ee5d2051b4478c639d977
SSDEEP 384:5QkUSv0sN0e0DZ/bJHX58EcOWJsUaAS2IguJIIlv:b0pxdabOV2S5guJLp
TLSH
T16F828D35A8A8AD379EF6A544F14A3643DFB49153E6886F94C6CD2B1C01DE2EC130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67289a58-2bec-4993-a1d1-5af171354510.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\67289a58-2bec-4993-a1d1-5af171354510.tmp
Size 8KB
SHA256 e7c3d0e14c0ae3a05f1d32d7092c633fa9dd131dfea0dbbf153343e9ba446ebb
MD5 293a7842e6685969842382d4143673b4
SHA1 b2bda77b917defbfddef1342e99e7de5c81c4e73
SHA512 bfe82b78cf785d344d6a6ab0b097e96fe5a311345df576b2193eb59aa4324e118bed517f06be39e11f5ee113576bd8b95d106690934d80c254ea361346f03a2a
SSDEEP 192:1ONF6wlDgQmiUy6bW4X58gZcOKBJBDlFOBA5U6:1ONF6kglW4X58EcOWJPNU6
TLSH
T1FE02E834F9787C7B9EF2AE09F58737139FA4116BE5552F84CAE81A1D00D729C2306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

6d7ebb14-5b03-4153-95a3-be9008f421e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d7ebb14-5b03-4153-95a3-be9008f421e7.tmp
Size 9KB
SHA256 26f0fc57a2d0cddbbd8671debbd7a8e7defaa2a856927dfaa9b689095413ef62
MD5 538403f41f2c5019a5791ff77358178e
SHA1 3c8b98cc375e67f79ac1dd8501495d9e6b786da7
SHA512 c8e7d78067dbe9261703b2eac7aab4b2bd9c0e59ada6d7b8508d670f51cf46421e362c5ba7d0d662bc5b6db5961a0f4202e1f9d0958ec6d1d87d99c38c11306f
SSDEEP 192:sxZ6RSWl/fHs4ZIdpZbHW6+WNcnE/YrWEpcIgrJ:sxZ6zl/fHs4yVHbH/t9
TLSH
T1BB22A8526E28A97B8CCBE20DBB25BF13D6F9547195D41E48EAFC851C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99363b60-14cb-4a1c-b452-7755ec80d8a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99363b60-14cb-4a1c-b452-7755ec80d8a3.tmp
Size 10KB
SHA256 37d48c27079c85f039f3b6313b0ca40135d44b18215a05e70c84a2b5f11cf6cd
MD5 db50d20c8074f1b19332c94076e1dd04
SHA1 bc817614d3624af2b196542a06d8b961e6ed37c5
SHA512 29a04003ac93f571bbb29ae85fb44fdd5a9acc95a68ba0b58edcb77c0d72f74748702370108c1940a2df94c47ced914df5f358f4853636ecd921cf466dafe61a
SSDEEP 192:sxZ6RSWl/fHs9ZIdpZbHW6+WNc8zXYrZIpcIg5SJ:sxZ6zl/fHs9yVHbfXqQ
TLSH
T1DE22A9526E38A97B8CCBE20DBB25BF13D6F9507295941E58AAFC851C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99cb6f77-64e0-4eae-884c-ea2f1096a2eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99cb6f77-64e0-4eae-884c-ea2f1096a2eb.tmp
Size 27KB
SHA256 48270f5a92c6edfcd43647dcbbd3e93db6ff090cb05f73d1c3f7f7ef9ac2d8f5
MD5 e78e7452c8605c1eee13fb6a45572f25
SHA1 91851bdcd06642615542272b8fff9d7104062b1f
SHA512 cecac26328f02033404156e4bf8f770df02916a4c90f41f911b9e41b03fbfe5db213781d272224e099d2b0e70b260c96d72f4523f3f279272d077af7ee7a522a
SSDEEP 768:j8y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbkroRex:j8y4J/DWvbtBhu1jajiLm0bvIx
TLSH
T162C20B3B644CCB7E4FC00A9DED5E6F973E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 529316ccc041bf4cc38681f026e49bd352dc3fa1155dc1673eead4b66470b596
MD5 a394722461972a04f8c67072318de305
SHA1 4ba94102f555d12967c703426650f31c2aa0fed1
SHA512 feeb2fad3b0125334a8ca4eac3f14ed3a507cbc1dd945403d2139a5a658c8698b850964608020766abeb425cf16a45b6250e481863260e1685b91e6507f63cda
TLSH
T11DE07DC407CCCA3EA61C7647016D730DC380365ED3C0AD8E5700EDC57405070B2C3690
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 52a3da1d516bfd98748ff026d2c90795040f1a77cc6b4ddbc84165533a6117f6
MD5 d80a3403ab0770f49f0330cc3503a657
SHA1 d68345eaaf236bc8d297173b4372b6fa5a994d81
SHA512 94fe64bf4ed434323c27e44332dc4315d04d22c348a7882d7cf590083a0e350d1171c1af27966cbd5da93e855d9939f77ba6bacbd4af53fd023d3f125a22690b
TLSH
T1B161A54B5C03C266F7A88470CDFF14AB36734D8375C39E122C9CE6BC980E726516A04E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 32a056c6a16a104dea60216f27a190b87f58b2693d72e60ee2c0c33c74d16187
MD5 31c35908fc359c4535a241ec12c00f16
SHA1 fe82ad40b64e712438ebb8307d4d46f3f2ef4763
SHA512 b4bb87b84f109fd641a09f5a4af11fb4743bc09ab6b6578d1927758885d7512cf55797388a7525c76b6de38b94e766fa890ce777da5e35b5488c92f73898eaf5
TLSH
T15D61824B5C42C266F7A88470CDFF10AB36774D83B4C3AD123DACE6BD840EB26615604E
MD5 SHA1 SHA512 TLSH

Submit Download

adee0719-13a8-4d91-b07c-c3d90e2e18b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\adee0719-13a8-4d91-b07c-c3d90e2e18b6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

14e4daf3-dc9f-4c09-ae15-a6044c29db3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\14e4daf3-dc9f-4c09-ae15-a6044c29db3e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

749279d4-252f-46d7-ae19-e0ca0422710c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\749279d4-252f-46d7-ae19-e0ca0422710c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 3f55dde8fbe7185e1c9f558ba5cdf43208eb8a0d039dd002b269bb747ac871f7
MD5 a49dc0ebe4cc1a14ddb6d46fe3623dc2
SHA1 daa674784eea7b83f135b658353645f86793099f
SHA512 b735011d70b4c07081b80b2c84bc7e2824e277236af6a2ec8fab87228ebab07cbc55de40179385317085a60b04053696491a2bbe8f876cabab0eb271a7a9234b
TLSH
T1EFA00257477D5001D41246F460DD554033968895410342194C90F0BCBCD5551F165549
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 c58351891fd0f9924e7e4cfc472a73c2f48af3e990413997878426fff14c0a5a
MD5 be618b06298f33b6132760e104a93fa4
SHA1 725105cf28f89d9e5a81dcbfd50f82e23cb2c2aa
SHA512 14d28d6e7a0cf47c1496b216643a0fc77236fc80144ff0ac12bf338f1a83192194a1c24c831e2871629a32ae38b3d80b7c2551d063a3901a524dbf90ed4cf48b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7ca1c458caa1d918fa4b351e8745df25eb53fb75e99d9ddd88f2ec994b4a628c
MD5 e16d5fbbbcef81c93a72722080f54e5f
SHA1 143025d1deb71395a41cdef92abeb169c4407026
SHA512 24efd5145967d834081c25b372b165fba7ee9b372c086579237665c3289699a32cfc67d4c75dbd0dad88ff500d4fa134c8e0c031ecb7507d9d209360be3f75c7
SSDEEP 48:KIDI1Ks04jyL5f5i5r5/5B5h5B5ab555U5pIS5P5aK95v15l5ax5/5KY5s5t5v5e:KIDCKs0+aS8K/aey2AK3qaq
TLSH
T1D691A690727B420138BD2A4851788B2B524131B33168E96F7FFC9166AE2BF155DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9315b81-778d-4879-b9a4-dad787bb3472.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b9315b81-778d-4879-b9a4-dad787bb3472.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef25aec2-e257-42b6-bf3f-0a4a0f206b48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef25aec2-e257-42b6-bf3f-0a4a0f206b48.tmp
Size 10KB
SHA256 9a8ff92cf98e5e30af7d192ff236ed3408f19deeb70214cdbcad6c0d45cc2e3b
MD5 ae3fa85e316c1c37752134254b58205e
SHA1 26c44aa877d7ddace7f5cda60eae78c7078deeb4
SHA512 d47e4bd5c63a54f9dfbd9d3c583a4eb00686619fca085784431f76bfc50111b360eb08c65ab30c7adb8b3f4b04a30f63d05b13f2f00a93770e979ec83a4a6268
SSDEEP 192:sxZ6RSWl/fHs7ZIdpZbHW6+WNcksdYrEIpcIg54J:sxZ6zl/fHs7yVHbMd7q
TLSH
T19822BA526E28A97B8CCBE20DBB257F13D6F9507295D41E48A6FC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f89aff95-d9c2-4660-b7bb-f051123bea39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f89aff95-d9c2-4660-b7bb-f051123bea39.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fffad19e6a71a970789c073bab36410f2fd4e9b761ef8209cc25732963de28cf
MD5 85256630bb82b5a6fe8d1987d0862444
SHA1 f69e65c33c06ff9a4a55ba5c2c7300657cdd4d5c
SHA512 82005dcb219629c67195362e747012fd1fafa20f82e89c5ab6494fd47dfb8231f70027f1d442c386d6bcef35e8f2db313d8962ce82574885c3e70ccc00d53c82
TLSH
T156412C58A6EA1108B3B76E1A9BF6646E887FB8372F0AD45E10010E4F0662B04C871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads